@andrian.yablonskyy/thub-coordinator 1.0.37 → 1.0.39

package/test/logs.test.js

@@ -0,0 +1,150 @@
+/**
+ * @file        packages/coordinator/test/logs.test.js
+ * @description Tests: job log paging for the dashboard viewer, the full SSE replay, and the raw log (RAW button)
+ *
+ * @author      Andrian Yablonskyy
+ * @copyright   Copyright (c) 2026 Andrian Yablonskyy. All rights reserved.
+ *
+ * This file is part of TestHub and is proprietary and confidential.
+ * Unauthorized copying, modification, distribution, or use of this file,
+ * via any medium, is strictly prohibited without prior written permission
+ * from AdSystem.PRO.
+ */
+
+'use strict';
+
+const test = require('node:test'),
+  assert = require('node:assert/strict'),
+  fs = require('node:fs'),
+  os = require('node:os'),
+  path = require('node:path'),
+  { loadConfig } = require('../src/config'),
+  { buildServices, createApp } = require('../src/server');
+
+// A Coordinator on a random port, an admin session, and one job with `n`
+// log lines ("line 1".."line n").
+async function setup(t, n){
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'thub-logs-')),
+    file = path.join(dir, 'coordinator.json');
+  fs.writeFileSync(file, JSON.stringify({
+    dataDir: path.join(dir, 'data'), sessionSecret: 'test-secret-test-secret', updates: { checkIntervalMin: 0 }
+  }));
+  const config = loadConfig(file),
+    services = buildServices(config),
+    server = createApp(config, services).listen(0, '127.0.0.1');
+  t.after(() => new Promise((r) => {
+    server.closeAllConnections?.();
+    server.close(r);
+  }));
+  await new Promise((r) => server.on('listening', r));
+  const base = `http://127.0.0.1:${server.address().port}`;
+
+  services.adminUsers.create({ username: 'admin', password: 'pw', role: 'admin' });
+  const login = await fetch(`${base}/login`, {
+      method: 'POST', body: new URLSearchParams({ username: 'admin', password: 'pw' }), redirect: 'manual'
+    }),
+    cookie = login.headers.get('set-cookie').split(';')[0],
+    { agent } = services.agents.create({ name: 'ci', kind: 'ci' });
+  services.registry.registerAuto({ clientId: 'c1', name: 'lab-sw-01', type: 'sw', labels: [] });
+  const job = services.jobs.create({ agentId: agent.id, source: 'ci', spec: { target: { type: 'sw' }, command: './t.sh' } });
+  for (let i = 0; i < n; i += 500){
+    services.logs.appendBatch(job.id, Array.from({ length: Math.min(500, n - i) }, (_, k) => ({ stream: 'runner', line: `line ${i + k + 1}` })));
+  }
+  const finish = () => services.db.prepare('UPDATE jobs SET state = ?, finished_at = ? WHERE id = ?').run('PASSED', new Date().toISOString(), job.id);
+  return { base, cookie, services, job, finish, get: (p) => fetch(`${base}${p}`, { headers: { cookie } }) };
+}
+
+test('log pages: the end first, then earlier pages until the start', async (t) => {
+  const { get, job } = await setup(t, 2500),
+    last = await (await get(`/jobs/${job.id}/logs?limit=1000`)).json();
+  assert.equal(last.total, 2500);
+  assert.equal(last.hasMore, true);
+  assert.equal(last.lines.length, 1000);
+  assert.equal(last.lines[0].line, 'line 1501');
+  assert.equal(last.lines.at(-1).line, 'line 2500');
+
+  const earlier = await (await get(`/jobs/${job.id}/logs?limit=1000&before=${last.lines[0].seq}`)).json();
+  assert.deepEqual([earlier.lines[0].line, earlier.lines.at(-1).line, earlier.hasMore], ['line 501', 'line 1500', true]);
+
+  const first = await (await get(`/jobs/${job.id}/logs?limit=1000&before=${earlier.lines[0].seq}`)).json();
+  assert.deepEqual([first.lines.length, first.lines[0].line, first.hasMore], [500, 'line 1', false]);
+
+  // Limits are clamped: never more than 5000 a request.
+  assert.equal((await (await get(`/jobs/${job.id}/logs?limit=999999`)).json()).lines.length, 2500);
+});
+
+test('log stream replays every line, not just the first 500', async (t) => {
+  const { get, job, finish } = await setup(t, 1234);
+  finish();
+  const text = await (await get(`/jobs/${job.id}/stream`)).text(),
+    lines = [...text.matchAll(/^event: log$/gm)].length;
+  assert.equal(lines, 1234);
+  assert.match(text, /"line":"line 1234"/);
+  assert.match(text, /event: end/);
+
+  // Resuming after a seq replays only what follows it.
+  const resumed = await (await get(`/jobs/${job.id}/stream?after=1200`)).text();
+  assert.equal([...resumed.matchAll(/^event: log$/gm)].length, 34);
+});
+
+test('RAW: the whole log as plain text, for as long as the job exists', async (t) => {
+  const { get, job, finish, services } = await setup(t, 6001),
+    res = await get(`/jobs/${job.id}/log.txt`),
+    text = await res.text();
+  assert.equal(res.status, 200);
+  assert.match(res.headers.get('content-type'), /^text\/plain; charset=utf-8/);
+  assert.equal(res.headers.get('x-content-type-options'), 'nosniff');
+  assert.match(res.headers.get('content-disposition'), new RegExp(`inline; filename="${job.id}.log"`));
+  const rows = text.trimEnd().split('\n');
+  assert.equal(rows.length, 6001); // more than one 5000-line page
+  assert.match(rows[0], /^\[\d{4}-\d\d-\d\dT[^\]]+\] \[runner\] line 1$/);
+  assert.match(rows.at(-1), /\] \[runner\] line 6001$/);
+
+  // Still complete once the job has finished — no retention of its own
+  // (log lines go with the job), and no artifact to fall back to.
+  finish();
+  assert.equal((await (await get(`/jobs/${job.id}/log.txt`)).text()).trimEnd().split('\n').length, 6001);
+  services.db.prepare('DELETE FROM job_logs WHERE job_id = ?').run(job.id);
+  assert.equal(await (await get(`/jobs/${job.id}/log.txt`)).text(), '');
+
+  assert.equal((await get('/jobs/M-99999/log.txt')).status, 404);
+});
+
+test('artifacts are gone: old Clients\' uploads are discarded, old Agents get none, the store is removed', async (t) => {
+  const { base, services, job } = await setup(t, 3),
+    { resourceId, resourceToken } = services.registry.registerAuto({ clientId: 'c9', name: 'lab-hw-09', type: 'hw', labels: [] }),
+    { token: agentToken } = services.agents.create({ name: 'old-agent', kind: 'cli' });
+  services.db.prepare('UPDATE jobs SET resource_id = ? WHERE id = ?').run(resourceId, job.id);
+
+  // An old Client still uploads its results after the job: accepted (so the
+  // job doesn't end in ERROR), stored nowhere.
+  const form = new FormData();
+  form.append('files', new Blob(['<testsuite tests="1"/>']), 'results.xml');
+  const upload = await fetch(`${base}/api/v1/jobs/${job.id}/artifacts`, {
+    method: 'POST', headers: { authorization: `Bearer ${resourceToken}` }, body: form
+  });
+  assert.equal(upload.status, 201);
+  assert.deepEqual(await upload.json(), { artifacts: [] });
+  assert.equal(fs.existsSync(path.join(path.dirname(services.db.name), 'artifacts')), false);
+
+  // An old Agent's `thub status` still asks: none.
+  const listed = await fetch(`${base}/api/v1/jobs/${job.id}/artifacts`, { headers: { authorization: `Bearer ${agentToken}` } });
+  assert.deepEqual(await listed.json(), { artifacts: [] });
+
+  // No table, no download route.
+  assert.equal(services.db.prepare('SELECT COUNT(*) AS n FROM sqlite_master WHERE name = ?').get('artifacts').n, 0);
+  assert.equal((await fetch(`${base}/artifacts/download/x.y.z`, { redirect: 'manual' })).status, 302); // just the login redirect
+});
+
+test('upgrade: a leftover <dataDir>/artifacts is deleted on startup', (t) => {
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'thub-legacy-')),
+    file = path.join(dir, 'coordinator.json'),
+    legacy = path.join(dir, 'data', 'artifacts', 'M-00001');
+  fs.mkdirSync(legacy, { recursive: true });
+  fs.writeFileSync(path.join(legacy, 'console.log'), 'old');
+  fs.writeFileSync(file, JSON.stringify({ dataDir: path.join(dir, 'data'), updates: { checkIntervalMin: 0 } }));
+  const log = t.mock.method(console, 'log', () => {});
+  buildServices(loadConfig(file));
+  assert.equal(fs.existsSync(path.join(dir, 'data', 'artifacts')), false);
+  assert.match(log.mock.calls[0].arguments[0], /no longer stores job artifacts/);
+});

package/test/scheduler.test.js

@@ -25,8 +25,8 @@ const test = require('node:test'),
   { createRegistryService } = require('../src/services/registry'),
   { createAgentsService } = require('../src/services/agents'),
   { createGroupsService } = require('../src/services/groups'),
-  { createArtifactsService } = require('../src/services/artifacts'),
   { createJobsService } = require('../src/services/jobs'),
+  { createLogsService } = require('../src/services/logs'),
   { createScheduler } = require('../src/services/scheduler'),
   { createHeartbeatMonitor } = require('../src/services/heartbeat'),
   { JOB_STATES, RESOURCE_STATES } = require('@andrian.yablonskyy/thub-common');
@@ -42,22 +42,19 @@ function buildTestServices(overrides = {}){
     registry = createRegistryService(db, { bus, events }),
     agents = createAgentsService(db, { events }),
     groups = createGroupsService(db, { events, registry }),
-    artifactsDir = fs.mkdtempSync(path.join(os.tmpdir(), 'thub-test-artifacts-')),
     config = {
       scheduler: { assignAckTimeoutSec: 15, requeueOnLost: true, maxQueuedPerAgent: 20, tickIntervalSec: 3600 },
       jobs: { defaultTimeoutSec: 1800, maxTimeoutSec: 14400 },
       heartbeat: { intervalSec: 10, missedLimit: 3, sweepIntervalSec: 3600 },
-      artifactsDir,
       sessionSecret: 'test-secret',
       publicUrl: 'http://localhost:8080',
-      artifacts: { linkTtlHours: 1 },
       ...overrides
     },
-    artifacts = createArtifactsService(db, { config }),
-    jobs = createJobsService(db, { bus, events, registry, artifacts, config }),
+    logs = createLogsService(db, { bus }),
+    jobs = createJobsService(db, { bus, events, registry, config }),
     scheduler = createScheduler(db, { bus, events, registry, config }),
     heartbeatMonitor = createHeartbeatMonitor(db, { bus, events, registry, jobs, config });
-  return { db, bus, registry, agents, groups, artifacts, jobs, scheduler, heartbeatMonitor, artifactsDir };
+  return { db, bus, registry, agents, groups, logs, jobs, scheduler, heartbeatMonitor };
 }
 
 function registerResource(registry, { name, type, labels = [], groups = [], clientId } = {}){
@@ -206,15 +203,16 @@ test('admin resetQueue cancels every active job and leaves finished ones alone',
   assert.equal(jobs.get(finished.id).state, JOB_STATES.PASSED); // untouched
 });
 
-test('admin cleanHistory deletes finished jobs, their artifacts on disk, and leaves active jobs alone', () => {
-  const { registry, agents, artifacts, jobs, artifactsDir } = buildTestServices(),
+test('admin cleanHistory deletes finished jobs with their log lines, and leaves active jobs alone', () => {
+  const { db, registry, agents, logs, jobs } = buildTestServices(),
     { agent } = agents.create({ name: 'ci', kind: 'ci' });
   registerResource(registry, { name: 'lab-sw-01', type: 'sw', labels: [] });
 
   const finished = jobs.create({ agentId: agent.id, source: 'cli', spec: makeSpec() });
   jobs.setState(finished.id, JOB_STATES.PASSED);
-  artifacts.storeGenerated(finished.id, 'console.log', Buffer.from('hello'), 'text/plain');
-  assert.ok(fs.existsSync(path.join(artifactsDir, finished.id)));
+  logs.appendBatch(finished.id, [{ stream: 'runner', line: 'hello' }]);
+  const logLines = (id) => db.prepare('SELECT COUNT(*) AS n FROM job_logs WHERE job_id = ?').get(id).n;
+  assert.equal(logLines(finished.id), 1);
 
   const active = jobs.create({ agentId: agent.id, source: 'cli', spec: makeSpec() }),
 
@@ -222,7 +220,7 @@ test('admin cleanHistory deletes finished jobs, their artifacts on disk, and lea
 
   assert.equal(deleted, 1);
   assert.equal(jobs.get(finished.id), undefined);
-  assert.equal(fs.existsSync(path.join(artifactsDir, finished.id)), false);
+  assert.equal(logLines(finished.id), 0);
   assert.ok(jobs.get(active.id)); // active job untouched
 });
 

package/test/search.test.js

@@ -0,0 +1,97 @@
+/**
+ * @file        packages/coordinator/test/search.test.js
+ * @description Tests: dashboard list search (?q=) — query parsing, in-memory matching and the Jobs page's SQL search
+ *
+ * @author      Andrian Yablonskyy
+ * @copyright   Copyright (c) 2026 Andrian Yablonskyy. All rights reserved.
+ *
+ * This file is part of TestHub and is proprietary and confidential.
+ * Unauthorized copying, modification, distribution, or use of this file,
+ * via any medium, is strictly prohibited without prior written permission
+ * from AdSystem.PRO.
+ */
+
+'use strict';
+
+const test = require('node:test'),
+  assert = require('node:assert/strict'),
+  { EventEmitter } = require('node:events'),
+  { openDb } = require('../src/db'),
+  { createEventsService } = require('../src/services/events'),
+  { createRegistryService } = require('../src/services/registry'),
+  { createAgentsService } = require('../src/services/agents'),
+  { createJobsService } = require('../src/services/jobs'),
+  { parseTerms, normalizeQuery, matches, likeClause, MAX_QUERY } = require('../src/services/search');
+
+test('parseTerms splits into lower-case, unique words, capped', () => {
+  assert.deepEqual(parseTerms('  Lab-HW   nucleo lab-hw '), ['lab-hw', 'nucleo']);
+  assert.deepEqual(parseTerms(''), []);
+  assert.deepEqual(parseTerms(undefined), []);
+  assert.deepEqual(parseTerms(['a']), []); // ?q=a&q=b arrives as an array: ignored
+  assert.equal(parseTerms(Array.from({ length: 30 }, (_, i) => `w${i}`).join(' ')).length, 10);
+  assert.equal(normalizeQuery(`  ${'x'.repeat(500)}`).length, MAX_QUERY - 2);
+});
+
+test('matches needs every word somewhere in the fields', () => {
+  const fields = ['lab-hw-01', 'IDLE', ['board:nucleo-f401re', 'uart'], null, [['10.0.0.7']]];
+  assert.ok(matches(fields, []));
+  assert.ok(matches(fields, parseTerms('NUCLEO idle')));
+  assert.ok(matches(fields, parseTerms('10.0.0')));
+  assert.ok(!matches(fields, parseTerms('nucleo busy')));
+});
+
+test('likeClause ANDs the words, ORs the columns and matches % and _ literally', () => {
+  const { sql, params } = likeClause(['a', 'b'], ['x', '50%_off']);
+  assert.equal(sql, '(COALESCE(a, \'\') LIKE ? ESCAPE \'\\\' OR COALESCE(b, \'\') LIKE ? ESCAPE \'\\\') AND ' +
+    '(COALESCE(a, \'\') LIKE ? ESCAPE \'\\\' OR COALESCE(b, \'\') LIKE ? ESCAPE \'\\\')');
+  assert.deepEqual(params, ['%x%', '%x%', '%50\\%\\_off%', '%50\\%\\_off%']);
+  assert.deepEqual(likeClause(['a'], []), { sql: '', params: [] });
+});
+
+test('jobs.page searches ids, users, resources, agents and spec fields — never --env values', () => {
+  const db = openDb(':memory:'),
+    bus = new EventEmitter(),
+    events = createEventsService(db),
+    registry = createRegistryService(db, { bus, events }),
+    agents = createAgentsService(db, { events }),
+    ci = agents.create({ name: 'ci-firmware', kind: 'ci' }).agent,
+    dev = agents.create({ name: 'alice-laptop', kind: 'cli' }).agent,
+    config = { scheduler: { maxQueuedPerAgent: 100 }, jobs: { defaultTimeoutSec: 60, maxTimeoutSec: 60 } },
+    jobs = createJobsService(db, { bus, events, registry, artifacts: {}, config });
+  registry.registerAuto({ clientId: 'c', name: 'lab-sw-01', type: 'sw', labels: [] });
+
+  const a = jobs.create({
+      agentId: ci.id,
+      source: 'ci',
+      spec: {
+        target: { type: 'sw' },
+        command: './ci/smoke.sh',
+        git: { url: 'git@github.com:yourorg/firmware-tests.git', ref: 'release/1.4' },
+        meta: { ciJobId: '9165432107' },
+        env: { API_TOKEN: 'hunter2-secret' }
+      }
+    }).id,
+    m = jobs.create({
+      agentId: dev.id,
+      source: 'cli',
+      spec: { target: { type: 'sw' }, command: 'make test', user: 'Alice Smith', suite: 'regression_50%' }
+    }).id,
+    ids = (q, extra = {}) => jobs.page({ q, size: 'all', ...extra }).rows.map((j) => j.id).sort();
+
+  assert.deepEqual(ids(''), [a, m].sort());
+  assert.deepEqual(ids(a.toLowerCase()), [a]); // job id, any case
+  assert.deepEqual(ids('alice'), [m]); // user and agent name
+  assert.deepEqual(ids('ci-firmware'), [a]); // agent name
+  assert.deepEqual(ids('firmware-tests release/1.4'), [a]); // git url + ref, both words
+  assert.deepEqual(ids('9165432107'), [a]); // meta
+  assert.deepEqual(ids('smoke alice'), []); // words must all match the same job
+  assert.deepEqual(ids('regression_50%'), [m]); // % and _ are literal…
+  assert.deepEqual(ids('regression_5%'), []); // …not wildcards
+  assert.deepEqual(ids('queued', { source: 'cli' }), [m]); // combines with filters
+  assert.equal(jobs.page({ q: 'make', size: 'all' }).pagination.total, 1);
+
+  // --env values are secrets (README §7.2): searching them must find nothing,
+  // or the search box would be an oracle for them.
+  assert.deepEqual(ids('hunter2'), []);
+  assert.deepEqual(ids('API_TOKEN'), []);
+});

package/test/session.test.js

@@ -0,0 +1,132 @@
+/**
+ * @file        packages/coordinator/test/session.test.js
+ * @description Tests: dashboard sessions — the SQLite session store, sessions surviving a restart, and the Secure cookie flag
+ *
+ * @author      Andrian Yablonskyy
+ * @copyright   Copyright (c) 2026 Andrian Yablonskyy. All rights reserved.
+ *
+ * This file is part of TestHub and is proprietary and confidential.
+ * Unauthorized copying, modification, distribution, or use of this file,
+ * via any medium, is strictly prohibited without prior written permission
+ * from AdSystem.PRO.
+ */
+
+'use strict';
+
+const test = require('node:test'),
+  assert = require('node:assert/strict'),
+  fs = require('node:fs'),
+  os = require('node:os'),
+  path = require('node:path'),
+  { promisify } = require('node:util'),
+  { openDb } = require('../src/db'),
+  { SqliteSessionStore } = require('../src/services/session-store'),
+  { loadConfig } = require('../src/config'),
+  { buildServices, createApp, cookieSecure } = require('../src/server');
+
+test('session store: get/set/touch/destroy, expired sessions dropped and pruned', async () => {
+  let now = Date.parse('2026-09-30T12:00:00Z');
+  const store = new SqliteSessionStore(openDb(':memory:'), { pruneIntervalMs: 0, now: () => now }),
+    get = promisify(store.get.bind(store)),
+    set = promisify(store.set.bind(store)),
+    touch = promisify(store.touch.bind(store)),
+    destroy = promisify(store.destroy.bind(store)),
+    length = promisify(store.length.bind(store)),
+    sess = (minutes) => ({ cookie: { expires: new Date(now + minutes * 60_000).toISOString() }, user: { id: 'u1' } });
+
+  await set('a', sess(60));
+  await set('b', sess(5));
+  assert.deepEqual((await get('a')).user, { id: 'u1' });
+  assert.equal(await get('nope'), null);
+  assert.equal(await length(), 2);
+
+  now += 10 * 60_000; // b's 5 minutes are up
+  assert.equal(await get('b'), null); // expired: gone on read
+  await touch('a', sess(60)); // activity moves a's expiry out
+  now += 55 * 60_000;
+  assert.ok(await get('a'));
+
+  await set('c', sess(1));
+  now += 2 * 60_000;
+  assert.equal(store.prune(), 1); // c, never read again, swept
+  assert.equal(await length(), 1);
+
+  await destroy('a'); // logout
+  assert.equal(await get('a'), null);
+});
+
+test('cookieSecure: Secure for an https publicUrl, per-request otherwise, or as configured', () => {
+  assert.equal(cookieSecure({ publicUrl: 'https://thub.example.com', session: { secureCookie: 'auto' } }), true);
+  assert.equal(cookieSecure({ publicUrl: 'http://localhost:8080', session: { secureCookie: 'auto' } }), 'auto');
+  assert.equal(cookieSecure({ publicUrl: 'https://thub.example.com', session: { secureCookie: false } }), false);
+  assert.equal(cookieSecure({ publicUrl: 'http://lab', session: { secureCookie: true } }), true);
+});
+
+// --- over HTTP ------------------------------------------------------------
+
+function writeConfig(dir, extra = {}){
+  const file = path.join(dir, 'coordinator.json');
+  fs.writeFileSync(file, JSON.stringify({
+    dataDir: path.join(dir, 'data'), sessionSecret: 'test-secret-test-secret', updates: { checkIntervalMin: 0 }, ...extra
+  }));
+  return file;
+}
+
+async function start(t, file){
+  const config = loadConfig(file),
+    services = buildServices(config),
+    server = createApp(config, services).listen(0, '127.0.0.1');
+  await new Promise((r) => server.on('listening', r));
+  const stop = () => new Promise((r) => {
+    server.closeAllConnections?.();
+    server.close(r);
+  });
+  t.after(stop);
+  return { base: `http://127.0.0.1:${server.address().port}`, services, stop };
+}
+
+const login = (base, headers = {}) => fetch(`${base}/login`, {
+  method: 'POST', headers, body: new URLSearchParams({ username: 'admin', password: 'pw' }), redirect: 'manual'
+});
+
+test('a signed-in session survives a Coordinator restart', async (t) => {
+  const file = writeConfig(fs.mkdtempSync(path.join(os.tmpdir(), 'thub-sess-'))),
+    first = await start(t, file);
+  first.services.adminUsers.create({ username: 'admin', password: 'pw', role: 'admin' });
+  const cookie = (await login(first.base)).headers.get('set-cookie').split(';')[0];
+  assert.equal((await fetch(`${first.base}/jobs`, { headers: { cookie }, redirect: 'manual' })).status, 200);
+  await first.stop();
+
+  const second = await start(t, file); // same database, new process state
+  assert.equal((await fetch(`${second.base}/jobs`, { headers: { cookie }, redirect: 'manual' })).status, 200);
+
+  await fetch(`${second.base}/logout`, { method: 'POST', headers: { cookie }, redirect: 'manual' });
+  assert.equal((await fetch(`${second.base}/jobs`, { headers: { cookie }, redirect: 'manual' })).status, 302);
+});
+
+test('https publicUrl: the session cookie is Secure; plain HTTP gets an explanation, not a login loop', async (t) => {
+  const file = writeConfig(fs.mkdtempSync(path.join(os.tmpdir(), 'thub-sess-')), { publicUrl: 'https://thub.example.com' }),
+    { base, services } = await start(t, file);
+  services.adminUsers.create({ username: 'admin', password: 'pw', role: 'admin' });
+
+  // Behind the (loopback, trusted) reverse proxy terminating TLS.
+  const viaProxy = await login(base, { 'X-Forwarded-Proto': 'https' }),
+    setCookie = viaProxy.headers.get('set-cookie');
+  assert.equal(viaProxy.status, 302);
+  assert.match(setCookie, /; Secure/);
+  assert.match(setCookie, /; HttpOnly/);
+  assert.match(setCookie, /; SameSite=Lax/);
+
+  // The proxy forgot X-Forwarded-Proto: no cookie could come back — say so.
+  const plain = await login(base);
+  assert.equal(plain.status, 400);
+  assert.equal(plain.headers.get('set-cookie'), null);
+  assert.match(await plain.text(), /Signing in needs HTTPS/);
+  assert.match(await (await fetch(`${base}/login`)).text(), /X-Forwarded-Proto: https/);
+});
+
+test('config: session.secureCookie must be "auto", true or false', () => {
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'thub-sess-'));
+  assert.equal(loadConfig(writeConfig(dir)).session.secureCookie, 'auto');
+  assert.throws(() => loadConfig(writeConfig(dir, { session: { secureCookie: 'yes' } })), /session\.secureCookie must be/);
+});

package/test/views.test.js

@@ -33,3 +33,33 @@ test('every view compiles', () => {
     assert.doesNotThrow(() => pug.compileFile(file), `${path.relative(VIEWS, file)}`);
   }
 });
+
+// The help page is mostly static text split over partials sharing mixins
+// (views/help/_mixins.pug): compiling each file alone doesn't catch a missing
+// mixin or a broken include, so render the whole page.
+test('help page renders every section with this Coordinator\'s URL', () => {
+  const html = pug.renderFile(path.join(VIEWS, 'help', 'index.pug'), {
+    user: { username: 'viewer', role: 'viewer', theme: 'auto' },
+    updates: {},
+    messages: [],
+    currentPath: '/help',
+    active: 'help',
+    title: 'Help',
+    coordinatorVersion: '1.2.3',
+    commonVersion: '1.0.0',
+    fmtDate: () => '',
+    coordinatorUrl: 'https://thub.example.test'
+  });
+  for (const id of ['overview', 'use-cases', 'quick-start', 'coordinator', 'agent-setup', 'client-setup',
+    'client-machines', 'docker', 'git', 'agent-cli', 'env', 'ci', 'troubleshooting']){
+    assert.match(html, new RegExp(`<section[^>]* id="${id}"`), `section #${id}`);
+    assert.match(html, new RegExp(`href="#${id}"`), `TOC entry for #${id}`);
+  }
+  assert.match(html, /thub config set url {3}https:\/\/thub\.example\.test/);
+  assert.match(html, /<a class="nav-link d-flex align-items-center active" href="\/help" aria-current="page"/);
+  // Troubleshooting: commands and parameters are <code>, placeholders escaped.
+  assert.match(html, /<code>journalctl -u thub-client@&lt;instance&gt; -f<\/code>/);
+  assert.match(html, /<span>The job is rejected with <code>422<\/code><\/span>/);
+  // Code placeholders are escaped, never parsed as tags.
+  assert.doesNotMatch(html, /<(url|jobId|groupId|resourceId|work|ref)>/);
+});

package/views/admin/agents.pug

@@ -1,12 +1,17 @@
 extends ../layout
 include ../mixins/updates
+include ../mixins/list-controls
 
 block content
   .d-flex.justify-content-between.align-items-center.mb-3
     h1.h4.mb-0 Agents (CI / developers)
     button.btn.btn-primary.btn-sm(type="button" data-bs-toggle="modal" data-bs-target="#addAgentModal") Register agent
-  .mb-3
-    +updatesToolbar('agent', 'agents', '/admin/agents')
+  .d-flex.flex-wrap.align-items-center.gap-2.mb-3
+    +updatesToolbar('agent', 'agents', list.pageUrl())
+  .d-flex.flex-wrap.align-items-center.gap-2.mb-3
+    +searchForm(q, 'Search agents: name, kind, version, status', list.urlFor({ q: '' }))
+    .ms-auto
+      +pageSizePicker(list)
 
   if newToken
     .alert.alert-warning
@@ -14,23 +19,26 @@ block content
       |
       code= newToken
 
+  div(data-live="list-toolbar")
+    +listToolbar(list, 'agents')
+
   table.table.table-hover.align-middle
     thead
       tr
-        th Name
-        th Kind
-        th Version
-        th Created
-        th Last used
-        th Status
+        +sortHeader(list, 'name', 'Name')
+        +sortHeader(list, 'kind', 'Kind')
+        +sortHeader(list, 'version', 'Version', 'desc')
+        +sortHeader(list, 'created', 'Created', 'desc')
+        +sortHeader(list, 'used', 'Last used', 'desc')
+        +sortHeader(list, 'status', 'Status')
         th
-    tbody
+    tbody(data-live="rows")
       each a in agents
         tr(class=a.revoked_at ? 'opacity-50' : '')
           td= a.name
           td.text-uppercase= a.kind
           //- A revoked token can't pick an update up: no button.
-          td: +versionWithUpdate(a.version, updates.latest.agent, a.update_to, `/admin/agents/${a.id}/update`, '/admin/agents', !a.revoked_at)
+          td: +versionWithUpdate(a.version, updates.latest.agent, a.update_to, `/admin/agents/${a.id}/update`, list.pageUrl(), !a.revoked_at)
           td= fmtDate(a.created_at)
           td= fmtDate(a.last_used_at, 'never')
           td= a.revoked_at ? 'revoked' : 'active'
@@ -50,12 +58,14 @@ block content
                   data-confirm-title="Revoke agent token?"
                   data-confirm-ok="Revoke"
                 )
+                  input(type="hidden" name="returnTo" value=list.pageUrl())
                   button.btn.btn-sm.btn-outline-danger(type="submit") Revoke
 
             .modal(tabindex="-1" id=`editAgentModal-${a.id}` aria-labelledby=`editAgentTitle-${a.id}`)
               .modal-dialog
                 .modal-content
                   form(method="post" action=`/admin/agents/${a.id}/rename`)
+                    input(type="hidden" name="returnTo" value=list.pageUrl())
                     .modal-header
                       h5.modal-title(id=`editAgentTitle-${a.id}`) Edit agent
                       button.btn-close(type="button" data-bs-dismiss="modal" aria-label="Close")
@@ -66,6 +76,14 @@ block content
                     .modal-footer
                       button.btn.btn-secondary(type="button" data-bs-dismiss="modal") Cancel
                       button.btn.btn-primary(type="submit") Save
+      else
+        tr
+          td.text-body-secondary(colspan="7")
+            if q
+              | No agent matches “#{q}”. 
+              a(href=list.urlFor({ q: '' })) Show all agents
+            else
+              | No agents yet.
 
   .modal(tabindex="-1" id="addAgentModal")
     .modal-dialog

package/views/groups/list.pug

@@ -1,4 +1,5 @@
 extends ../layout
+include ../mixins/list-controls
 
 block content
   .d-flex.justify-content-between.align-items-center.mb-3
@@ -6,10 +7,18 @@ block content
     if canManage
       button.btn.btn-primary.btn-sm(type="button" data-bs-toggle="modal" data-bs-target="#addGroupModal") Add group
 
-  p.text-body-secondary.small.
+  p.text-body-secondary.small: i.
     A job can be constrained to run only on resources in a group with `thub run --group <id>` (§13.1).
     A resource joins a group by listing its id under `groups` in the Client's own config — membership isn't set here.
 
+  if totalCount
+    .d-flex.flex-wrap.align-items-center.gap-2.mb-2
+      +searchForm(q, 'Search groups: name, id, comment', '/groups')
+      if q
+        span.small.text-body-secondary
+          | #{groups.length} of #{totalCount} groups
+          +searchNote(q)
+
   if groups.length
     table.table.table-hover.align-middle
       thead
@@ -77,6 +86,10 @@ block content
                             i.bi.bi-clipboard
                       .modal-footer
                         button.btn.btn-primary(type="submit") Save
+  else if q
+    p.text-body-secondary
+      | No group matches “#{q}”. 
+      a(href="/groups") Show all groups
   else
     p.text-body-secondary No groups yet.